A  RESPONSE  TO  MISSTATEMENTS  IN  RELATION  TO  CAMBRIDGE  ANALYTICA 


INTRODUCTORY  BACKGROUND  TO  THE  COMPANIES 


Mr  Wylie  was  the  Director  of  Research  for  SCL  and  Cambridge  Analytica  from  2013  to  the  end  of  2014. 
SCL  Group  is  a  UK-based  military  contractor  that  specialises  in  Information  Operations  (“IO”).  SCL’s 
clients  have  included  the  UK  Ministry  of  Defence,  US  Department  of  Defense  and  various  NATO 
militaries.  Information  Operations  is  the  area  of  military  strategy  that  deploys,  manipulates  or  weaponises 
information  to  support  operational  objectives.  Within  10,  there  are  related  fields  such  as  Psychological 
Operations  and  Cyber  Operations. 

It  is  important  to  highlight  that  as  10  is  a  military  strategy,  which  is  often  deployed  in  combat  situations 
where  the  Data  Protection  Act  would  not  apply,  many  10  approaches  are  not  generally  congruent  with  the 
Data  Protection  Principles.  This  is  because  there  are  two  key  objectives  of  10.  The  first  is  the  notion  of 
“informational  dominance’’,  which  focuses  on  capturing,  interfering  or  manipulating  as  many  channels  of 
information  surrounding  the  target  as  possible.  This  is  typically  done,  by  necessity,  without  the 
knowledge  of  the  target.  The  second  is  using  information  collected  about  the  target  to  identify  and  then 
exploit  mental  vulnerabilities  to  provoke  certain  behaviours  in  the  target  that  would  be  conducive  to 
operational  objectives. 

Cambridge  Analytica  (“CA”)  was  created  by  SCL  Group  with  funding  from  Robert  Mercer,  an  American 
billionaire  based  in  New  York.  Robert  Mercer  installed  the  alt-right  political  activist  Stephen  Bannon  as 
CA’s  Vice  President  with  responsibilities  to  manage  the  company  day-to-day.  Mr  Mercer  wanted  to  use 
the  10  tactics  SCL  had  used  on  military  projects  for  his  political  aims  in  the  United  States,  and  elsewhere, 
including  the  United  Kingdom.  CA’s  focus  was  to  adapt  these  strategies  for  politics,  as  well  as  research 
ways  to  modernise  and  deploy  10  approaches  in  online  social  networks.  CA  does  not  have  any  staff,  only 
an  intellectual  property  licence  and  data  assets.  SCL  licenced  all  its  IP  to  CA  and  in  return  CA  signed  an 
exclusive  service  provision  agreement  whereby  all  CA  clients  would  be  handed  to  SCL  staff  to  work  on. 
Although  there  are  technical  legal  distinctions  between  CA  and  SCL,  this  is  largely  to  get  around  various 
electoral  compliance  and  foreign  agent  restrictions  in  the  USA.  It  should  be  noted  that  in  practice  CA  and 
SCL  operate  day-to-day  as  the  same  company.  The  two  companies  share  the  same  offices  and  many  of 
the  same  directors. 

Aggregate  IQ  (“AIQ”)  is  a  Canadian  company  that  was  set  up  to  service  SCL  and  later  CA  projects  and 
build  database,  CRM  and  online  advertising  technologies  for  SCL/CA.  Prior  to  SCL,  AIQ  had  no  other 
clients.  The  reason  AIQ  was  set  up  originally  was  because  several  key  people,  who  later  became  the 
principle  officers  of  AIQ,  were  not  mobile  to  move  to  London  for  family  reasons.  The  compromise  was  to 
establish  a  company  in  Canada  and  IP  agreements  would  be  reached  so  that  SCL/CA  would  own  the 
products  of  their  work.  To  the  best  of  Mr  Wylie’s  knowledge,  AIQ  had  no  independent  clients  outside  of 
SCL/CA  from  2013  to  2016.  The  IP  licence  and  contracts  between  AIQ  and  CA/SCL  are  in  the 
possession  of  the  committee.  AIQ  was  listed  as  “SCL  Canada”  on  the  SCL  website  and  internal  staff  lists 
in  the  possession  of  the  committee  also  lists  Zack  Massingham,  the  CEO  of  AIQ,  as  “Head  of  SCL 
Canada”.  These  staff  lists  also  show  that  AIQ  was  responsible  for  hiring  and  managing  a  division  of 
SCL/CA’s  software  engineers. 


FACEBOOK  DATA  AND  PSYCHOGRAPHICS 


“Cambridge  Analytica  has  not  processed  Facebook  data.” 

This  has  been  the  historic  line  used  by  Cambridge  Analytica  [“CA”].  Alexander  Nix  said  to  both  the  UK 
Parliament  and  US  Congress  that  the  firm  did  not  possess  or  use  Facebook  data. 

In  2014,  the  firm  hired  Global  Science  Research  [“GSR”]  Dr  Kogan’s  consulting  company,  to  use  an 
application  to  harvest  millions  of  Facebook  records  for  use  in  psychological  profiling.  This  is  evidenced 
by  the  GSR  contract  published  by  the  DCMS  Select  Committee  at  the  UK  Parliament.  The  contract 
includes  very  specific  language  that  the  origin  of  the  data  would  be  from  Facebook  and  that  friend  data 
would  also  be  harvested  in  that  process.  In  fact,  harvesting  friend  data  was  presented  as  the  core  unique 
selling  point  for  this  approach.  The  CEO  of  CA  Alexander  Nix  signed  that  contract.  Extensive  email 
correspondence  given  to  the  committee  also  shows  the  use  of  Facebook  data,  some  of  which  has  also 
been  published. 

There  is  also  video  recording  of  CA  staff  discussing  modelling  Facebook  like  data  from  November  2015 
(https://youtu.be/lhvX9QCiZP0).  The  staff  member  describes  the  same  process  for  modelling  Facebook 
data  as  the  original  GSR  project. 

“The  data  received  from  GSR  were  derivatives,  not  Facebook  data.” 

This  is  merely  a  semantic  distinction.  Derivatives  simply  mean  that  the  origin  source  data  has  been 
processed  or  transformed  in  some  way,  but  the  underlying  information  is  still  preserved.  Facebook  terms 
and  conditions  are  inclusive  of  derivatives  in  its  definition  of  Facebook  data.  Global  Science  Research 
provided  Cambridge  Analytica  with  processed  Facebook  derivatives  that  were  in  a  format  that  could  be 
easily  ingested  into  its  modelling  operation. 

A  simple  way  to  think  about  derivatives  is  when  you  translate  a  French  text  into  English.  In  that  case, 
English  would  be  a  derivative,  as  the  “data  format”  is  now  different,  but  the  underlying  information  is 
preserved. 

“This  was  standard  practice  at  the  time  and  allowed  by  Facebook.” 

It  is  true  that  Cambridge  Analytica  exploited  vulnerabilities  in  how  Facebook  was  set  up  at  the  time.  This 
does  not  mean,  however,  that  this  was  permitted  or  compliant  with  the  Data  Protection  Act. 

“The  Obama  campaign  did  the  same  thing.” 

The  Obama  campaign  did  not  use  a  foreign  military  contractor  to  develop  psychological  profiling 
algorithms  using  misappropriated  Facebook  data  on  upwards  of  87  million  unsuspecting  data  subjects. 

“GSR  put  in  the  terms  and  conditions  that  it  may  sell  the  data.” 

GSR  did  have  a  term  in  the  app  terms  and  conditions  that  said  it  may  sell  or  transfer  the  data.  However, 
no  terms  and  conditions  can  override  the  law.  This  means  that  while  the  primary  app  user  may  have 
technically  consented  to  their  data  being  used,  the  law  does  not  give  a  friend  permission  to  consent  on 
behalf  of  another  person. 

“The  GSR  contract  said  it  complied  with  the  Data  Protection  Act.” 

Yes,  but  this  does  not  mean  that  it  actually  did.  As  data  controllers,  both  Cambridge  Analytica  and  GSR 
had  a  substantive  duty  to  ensure  that  data  it  was  acquiring  was  done  so  with  consent  and  in  compliance 
with  the  DPA. 


“Mr  Wylie  was  the  manager  for  the  GSR  project,  so  he  is  responsible  for  it.” 

Cambridge  Analytica  is  the  Data  Controller,  not  Mr  Wylie.  Mr  Wylie  did  not  authorise  and  sign  the  GSR 
contract,  the  firm’s  CEO  Alexander  Nix  did.  Mr  Wylie  did  not  fund,  scale  or  expand  the  project, 
Cambridge  Analytica  did.  Mr  Wylie  did  not  carry  out  the  Facebook  data  harvesting,  GSR  and  Dr  Kogan 
did.  When  Mr  Wylie  left  CA,  the  firm  still  continued  with  the  GSR  project. 

However,  Mr  Wylie  has  been  fully  open  and  transparent  about  his  role  in  setting  up  Cambridge  Analytica 
and  his  role  on  the  GSR  project.  By  going  public,  he  has  gone  out  of  his  way,  at  much  personal  expense, 
to  try  to  correct  the  mistakes  that  were  made.  He  has  accepted  his  share  of  responsibility.  It  is  the  case 
for  most  whistleblowers  that  they  were  involved  in  some  way  in  the  problems  that  they  later  choose  to 
report.  It  was  Mr  Wylie,  not  Cambridge  Analytica  or  GSR,  who  decided  to  come  forward  to  report  the 
project  to  the  authorities  or  media. 

“No  Facebook  data  was  used  on  the  Trump  campaign.” 

The  basis  of  all  CA  models,  including  political  affiliation  and  turnout  models,  were  originally  trained  using 
the  Facebook  derived  GSR  data.  Even  if  Facebook  data  itself  was  not  used  directly  on  the  Trump 
campaign,  the  algorithms  were  still  built  using  Facebook  derivatives. 

However,  it  is  public  domain  that  Trump’s  voter  targeting  operation,  called  Project  Alamo,  made  extensive 
use  of  Facebook  targeting  and  Facebook  also  had  staff  embedded  with  the  Trump  campaign.  Cambridge 
Analytica  also  worked  on  Project  Alamo,  so  it  is  difficult  to  believe  that  they  did  not  come  into  contact  or 
make  use  of  Facebook  data. 

“No  psychographic  data  was  used  on  the  Trump  campaign  because  there  was  no  time.” 

Cambridge  Analytica  has  previously  said  that  there  was  “no  time”  to  “update”  the  psychographic  models 
used  on  the  Cruz  campaign  for  Trump  because  they  only  officially  joined  in  late  summer  2016.  However, 
this  makes  no  sense  because  voter  personality  is  an  enduring  characteristic  (like  gender)  and  so  there 
would  be  no  need  to  “update”  the  models.  It  would  be  like  saying  that  because  the  firm  was  switching 
campaigns  they  would  also  have  to  “update”  the  gender  of  all  records. 

Further,  the  firm  had  been  in  contact  with  the  Trump  campaign  for  far  longer  than  it  cares  to  admit. 
Cambridge  Analytica  lawyers  confirmed  to  Mr  Wylie  that  Alexander  Nix  met  with  the  soon-to-be  Trump 
campaign  manager  Corey  Lewendowski  back  in  spring  2015,  before  Trump  had  even  announced  his 
campaign.  Mr  Nix  discussed  with  Mr  Lewendowski  the  use  of  Facebook  derived  data  and 
psychographics  at  that  meeting.  Legal  correspondence  from  CA  referencing  these  meetings  are  in  the 
possession  of  the  committee. 

“Cambridge  Analytica  only  uses  commercial  data  to  do  psychographics.” 

This  is  difficult  to  believe  because  internal  reports,  which  have  been  passed  to  the  committee,  show  that 
the  commercial  data  that  the  firm  says  they  use  do  not  have  strong  relationships  with  nuanced  constructs. 
Also  the  commercial  data  the  firm  uses  has  a  high  degree  of  “matrix  sparsity”  which  means  that  although 
there  may  be  “4,000-5,000”  features  in  the  dataset,  most  records  are  actually  blank  for  those  features. 
Many  features  only  have  a  coverage  rate  of  only  2-5%  which  means  that  95-98%  of  voters  in  the  dataset 
do  not  have  an  observation  for  that  feature.  This  is  why  the  “4,000-5,000  data  points”  claim  is  misleading, 
as  it  refers  to  a  feature  set  of  possible  observations,  but  it  does  not  mean  that  the  coverage  is  high.  So 
the  commercial  data  referred  to  in  the  internal  reports  would  not  have  been  useful  for  psychological 
targeting  as  it  did  not  contain  enough  information  to  be  effective. 

“AIQ  did  not  have  access  to  any  Facebook  derived  data.” 

The  data  security  firm  UpGuard  revealed  exposed  code  repositories  that  showed  AIQ  developers  working 
on  code  for  Cambridge  Analytica’s  Ripon  software  in  August  2015.  Ripon  was  the  platform  CA  used  to 


deploy  targeting  derived  from  the  misappropriated  Facebook  data.  In  fact,  internal  emails  in  the 
possession  of  the  committee  show  senior  AIQ  staff  discussing  accessing  the  “Kogan  data”  from  SCL/CA’s 
servers  for  the  Bolton  PAC. 


“There  is  no  evidence  that  psychological  profiling  works.” 

The  following  studies  highlight  the  efficacy  of  using  social  media,  natural  language  or  Internet  clickstream 
data  for  psychological  profiling  or  mass  persuasion: 


•  Eichstaedt,  J.  C.  et  al.  (2015).  Psychological  language  on  Twitter  predicts  county-level  heart  disease  mortality. 

Psychological  Science.  26,  159-169 

•  Kosinski  et  al.  (2013).  Manifestations  of  user  personality  in  website  choice  and  behaviour  on  online  social 
networks.  Journal  of  Machine  Learning.  DOI  1 0.1 007/si 0994-01 3-541 5-y. 

•  Kosinski,  M.,  Stillwell,  D..  &  Graepel,  T.  (2013).  Private  traits  and  attributes  are  predictable  from  digital  records  of 
human  behavior.  Proceedings  of  the  National  Academy  of  Sciences  of  the  United  States  of  America,  110,  5802-5805. 

•  Kosinski,  M.  et  al.  (2016).  Mining  Big  Data  to  Extract  Patterns  and  Predict  Real-Life  Outcomes.  Psychological 
Methods,  21(4),  493-506. 

•  Kramer,  A.  D.  I.,  Guillory,  J.  £.,  &  Hancock,  J.  T.  (2014).  Experimental  evidence  of  massive-scale  emotional 

contagion  through  social  networks.  Proceedings  of  the  National  Academy  of  Sciences  of  the  United  States  of  America, 
1 1 1,  8788-8790. 

•  Lambiotte,  R.  &  Kosinski,  M.  (2014).  Tracking  the  Digital  Footprints  of  Personality.  Proceedings  of  the  IEEE,  102(12), 
1934-1939. 

•  Lewandowsky,  S.  et  al.  (2012).  Misinformation  and  Its  Correction:  Continued  Influence  and  Successful  Debiasing. 

Psychological  Science  in  the  Public  Interest,  13(3),  106-131. 

•  Matz,  S.  C.  et  al.  (201 7).  Psychological  targeting  as  an  effective  approach  to  digital  mass  persuasion.  Proceedings 
of  the  National  Academy  of  Sciences  (PNAS),  114(48)  12714-12719. 

•  Mondak,  J.  et  al.  (2010).  Personality  and  Civic  Engagement:  An  Integrative  Framework  for  the  Study  of  Trait 
Effects  on  Political  Behavior.  American  Political  Science  Review,  104,  85-1 10. 

•  Nam,  H.  et  al.  (2013).  "Not  for  All  the  Tea  in  China!"  Political  Ideology  and  the  Avoidance  of  Dissonance-Arousing 
Situations.  PLOS  ONE,  8,  e59837. 

•  Nyhan,  B.  &  Reifler,  J.  (2010).  When  Corrections  Fail:  The  Persistence  of  Political  Misperceptions.  Journal  of 
Political  Behavior,  32,  303-330. 

•  Quercia,  D.  et  al.  (2011).  Our  Twitter  Profiles ,  Our  Selves:  Predicting  Personality  with  Twitter.  IEEE  Third 
International  Conference  on  Social  Computing,  180-185. 

•  Schwartz,  H.  A.  et  al.  (2013).  Personality,  gender,  and  age  in  the  language  of  social  media:  The  open-vocabulary 
approach.  PLOS  ONE,  8,  e73791. 

•  Youyou,  W..  Kosinski,  M..  &  Stillwell,  D.  J.  (2015).  Computer-based  personality  judgements  are  more  accurate  than 
those  made  by  humans.  Proceedings  of  the  National  Academy  of  Sciences  (PNAS),  112,  1036-1040. 


RUSSIA 


“Cambridge  Analytica  did  not  collude  with  Russia.” 

To  be  clear,  no  specific  allegation  has  been  made  that  CA,  AIQ,  Mr  Nix  or  Dr  Kogan  knowingly  colluded 
with  the  FSB  or  other  Russian  agents.  However,  a  clear  risk  of  data  breaches  was  created  by  CA’s 
apparent  recklessness  in  the  face  of  highly  skilled  foreign  intelligence  and  cyber  operations. 

During  the  Facebook  harvesting  scheme,  the  lead  psychologist  on  the  project,  Dr  Aleksandr  Kogan  was 
also  working  on  a  Russian-funded  research  project  at  St  Petersburg  University  on  scaled  psychological 
profiling  of  data  subjects.  Dr  Kogan’s  research  focused  on  online  trolls  and  Dark  Triad  personality  traits 
(Machiavellianism,  Narcissism  and  Psychopathy). 

Contemporaneous  to  Dr  Kogan’s  psychological  profiling  and  online  troll  research  in  Russia,  CA  was  also 
in  close  contact  with  senior  executives  at  Lukoil,  one  of  Russia’s  largest  oil  companies.  After  receiving  a 
request  for  information  from  Lukoil  about  CA’s  work  in  the  spring  of  2014,  CA  discussed  with  Lukoil  its 
experience  with  foreign  disinformation,  rumour  campaigns,  microtargeting  and  its  data  assets  from  Ripon. 
This  is  documented  in  correspondence  and  slide  decks  in  the  committee’s  possession.  As  a  note,  CA’s 
history  of  working  in  Nigeria  is  a  focus  of  this  presentation. 

It  should  be  noted  that  Lukoil  has  formal  information  sharing  agreements  with  the  Russian  Federal 
Security  Service  (“FSB”)  and  is  known  to  conduct  intelligence  gathering  on  behalf  of  the  FSB  with 
European  companies  it  engages. 

It  should  also  be  noted  that  CA’s  parent  company,  SCL  Group,  manages  NATO  psychological  operations 
projects  in  the  Baltic  region  and  would  have  likely  already  been  an  intelligence  target  for  the  FSB.  This 
means  that  in  addition  to  processing  Facebook  data  in  Russia,  there  are  reasonable  grounds  to  suspect 
that  CA  may  have  been  an  intelligence  target  of  Russian  security  services  at  the  time  of  Project  Ripon, 
that  the  FSB  may  have  been  notified  of  the  existence  of  CA’s  Facebook  data  and  that  they  could  covertly 
access  those  same  data  assets  inside  Russia  via  accessing  Dr  Kogan’s  work  and  computers.  There  are 
also  reasonable  grounds  to  investigate  the  extent  of  Dr  Kogan’s  knowledge  of  any  such  accessing. 

As  Data  Controller,  CA  had  a  legal  duty  to  ensure  the  data  was  protected  from  these  threats.  Cambridge 
Analytica’s  behaviour  was  also  reckless  given  its  extensive  experience  working  in  counterterrorism  and 
military  projects  for  the  British  and  American  governments.  However,  the  company  has  a  documented 
history  of  reckless  handling  of  sensitive  data. 

In  2014,  SCL  Group,  the  parent  of  CA,  was  criticised  by  the  UK  Defence  Science  and  Technology 
Laboratory  (a  part  of  the  UK  Ministry  of  Defence)  for  mishandling  sensitive  Ministry  of  Defence 
information.  The  DSTL  assessment  was  done  in  the  same  year  as  the  GSR  Facebook  harvesting 
scheme. 

“Cambridge  Analytica  did  not  know  that  Aleksandr  Kogan  was  working  on  psychological  profiling 
work  in  Russia.” 

On  15  March  2014,  an  email  addressed  to  Mr  Nix  stated  that  SCL  staff  were  pitching  “the  interesting  work 
Alex  Kogan  has  been  doing  for  the  Russians”  to  other  SCL  clients.  This  has  been  given  to  the 
committee. 

“Cambridge  Analytica’s  pitch  to  Lukoil  was  only  for  a  small  customer  loyalty  project  in  Turkey.” 

What  the  project  was  or  was  not  “officially”  for  is  beside  the  point.  Alexander  Nix  is  on  record  in  emails 
stating  that  he  was  sending  whitepapers  authored  by  Mr  Wylie  on  the  firm’s  US-based  data  and  targeting 
capacity  to  senior  executives  at  Lukoil  -  including  the  CEO  of  Lukoil.  This  is  with  the  committee.  Further, 
the  pitch  deck  created  by  Alexander  Nix  for  Lukoil  began  with  slides  on  “Rumour  campaigns”  and  on  voter 


“inoculation”  in  Nigeria.  This  is  also  with  the  committee.  It  is  difficult  to  understand  how  these  slides 
related  in  any  way  to  a  small  customer  loyalty  project  in  Turkey. 

ETHICS  AND  SECURITY 


“Cambridge  Analytica  does  not  use  misinformation,  bribes,  hackers,  kompromat  or  voter 
intimidation.” 

In  early  2015,  video  content  was  prepared  by  Cambridge  Analytica  as  part  of  their  “viral  ops”  campaign  in 
Nigeria.  This  video  was  intended  to  intimidate  voters  in  certain  regions  of  Nigeria  and  suppress  voters 
who  were  more  likely  to  support  Major  General  Muhammadu  Buhari,  who  was  at  the  time  a  presidential 
candidate  and  who  is  now  the  current  President  of  Nigeria.  This  video,  which  is  in  the  committee’s 
possession,  contains  graphic  and  sadistic  footage  of  the  following: 

•  Public  beatings  and  floggings 

•  Forced  genital  mutilation  and  amputation  with  a  machete 

•  Public  burning  and  immolation  of  a  victim 

•  Victims  having  their  throats  cut  and  being  dumped  into  a  ditch 

•  Muslims  being  presented  in  a  menacing  and  threatening  manner 

•  Implied  threats  of  physical  harm  to  the  viewer 

This  video  was  produced  in  line  with  the  views  of  CA’s  senior  staff  about  what  is  acceptable  campaign 
practice.  In  recordings  given  to  the  committee  by  Dr  Emma  Briant,  the  CEO  of  SCL  Group  said  that:  “Of 
course  Hitler  attacked  the  Jews.  He  didn't  have  a  problem  with  the  Jews  at  all,  but  the  people  didn't  like 
the  Jews.  So  if  the  people  —  he  could  just  use  them  to  say  —  so  he  just  leveraged  an  artificial  enemy. 
Well,  that's  exactly  what  Trump  did.  He  leveraged  a  Muslim  —  /  mean,  you  know,  it's  —  it  was  a  real 
enemy.”  It  should  be  noted  that  Trump  was  a  client  of  CA. 

Voter  suppression  operations  did  not  just  happen  in  Africa.  Mr  Wylie  has  stated  previously  that  CA’s  work 
for  PACs  in  the  United  States  had  voter  suppression  as  an  objective,  particularily  for  African  Americans. 
The  committee  is  also  in  possession  of  documents  that  reference  “voter  disengagement”  as  an  objective 
on  American  projects. 

Documents  sent  to  Lukoil  created  by  Alexander  Nix  includes  sections  on  “Rumour  campaigns”  and  on 
voter  “inoculation”  in  Nigeria.  These  are  references  to  disinformation.  Mr  Nix  also  said  to  a  Channel  4 
undercover  reporter  that,  “these  are  things  that  don’t  necessarily  need  to  be  true  as  long  as  they’re 
believed."  He  added  that,  “it  has  to  happen  without  anyone  thinking  it’s  propaganda”. 

In  the  Channel  4  undercover  sting,  Mr  Turnbull  described  the  covert  and  deceptive  nature  of  CA’s  online 
tactics  by  saying  that  “this  stuff  infiltrates  the  online  community  and  expands  but  with  no  branding — so  it’s 
unattributable,  untrackable.” 

Mr  Nix  makes  reference  to  using  Ukrainian  sex  workers  to  collect  kompromat  of  an  opposition  candidate. 
Mr  Nix  proposed  to  make  “an  offer  he  can’t  refuse”  and  to  “send  some  girls  around  to  the  candidate’s 
house.”  This  is  not  just  loose  talk.  The  Times  of  London  revealed  video  footage  showing  that  SCL 
attempted  to  entrap  an  opposition  candidate  by  posing  as  an  international  property  developer  offering  $1 
million  to  support  his  election  campaign  in  return  for  land  in  St  Kitts  &  Nevis. 

CA’s  parent  company  SCL  Group  has  been  reported  to  the  police  for  potential  bribery  offences  and 
international  corruption.  In  late  2013,  Alexander  Nix  met  with  the  then  Minister  of  Health  of  Ghana  and 
proposed  to  her  to  use  her  position  as  Minister  to  grant  SCL  a  publicly  funded  project.  In  exchange,  SCL 
would  divert  the  Ministry  of  Health  (“MOH”)  funds  to  her  election  expenses  to  give  the  party  an  unfair 
advantage  in  the  upcoming  parliamentary  election.  The  Minister  agreed  on  these  terms  and  authorised 
MOH  to  fund  the  SCL  project.  Documents  in  the  possession  of  the  committee  make  clear  that  that  the 
project  instead  “will  act  as  a  prelude  to  an  election  campaign".  It  is  clear  from  this  scheme  that  Mr  Nix 


and  SCL  induced  the  Minister  to  abuse  her  position  as  a  public  official  in  order  to  divert  and  misuse  public 
Ministry  of  Health  funds  for  unlawful  political  purposes.  SCL  gained  financially  from  this  scheme. 

CA  has  also  been  reported  to  the  police  for  hacking  and  cybercrime  related  offences.  In  January  2015, 
CA  procured  the  services  of  an  Israeli  private  intelligence  firm  known  for  its  technical  sophistication.  The 
relationship  with  this  Israeli  private  intelligence  firm  was  fostered  by  Brittney  Kaiser,  who  was  then  the 
firm’s  Director  of  Business  Development.  The  firm  was  instructed  by  CA  in  their  London  office  to  hack  the 
private  e-mail  account  and  computer  of  Major  General  Muhammadu  Buhari,  who  was  at  the  time  a 
presidential  candidate  and  who  is  now  the  current  President  of  Nigeria. 

CA  staff  managing  the  campaign  were  then  handed  the  hacked  material  and  used  its  content  for  strategic 
intelligence  to  assist  their  candidate,  Goodluck  Jonathan,  in  the  election  and  as  kompromat  to  launch 
rumour  campaigns  about  Buhari’s  health,  wellbeing  and  fitness  to  become  president.  Some  of  this 
kompromat  has  been  published  in  the  Guardian. 

When  at  the  firm,  Alexander  Nix  told  Mr  Wylie  explicitly  about  CA’s  “black  ops”  capacity,  which  included 
using  hackers  to  break  into  computer  systems  to  acquire  kompromat.  Mr  Wylie  also  was  told  that 
whenever  this  was  being  offered  to  clients,  CA/SCL  would  list  and  bill  it  as  “special  IT  services”. 

Mr  Wylie  and  his  lawyers  have  also  personally  spoken  to  several  of  ex-staff  members  recently,  who  have 
all  re-confirmed  the  details  of  various  hacking  schemes,  including  another  project  involving  the  Prime 
Minister  of  St  Kitts  and  Nevis.  Some  of  them  have  now  reported  this  to  the  authorities. 

“Cambridge  Analytica  does  not  have  any  security  issues.” 

In  2014,  SCL  Group,  the  parent  of  CA,  was  criticised  by  the  UK  Defence  Science  and  Technology 
Laboratory  (a  part  of  the  UK  Ministry  of  Defence)  for  mishandling  sensitive  Ministry  of  Defence 
information.  The  DSTL  assessment  was  done  in  the  same  year  as  the  GSR  Facebook  harvesting 
scheme.  The  committee  is  in  possession  of  this  assessment. 

Mr  Wylie  has  provided  the  committee  of  examples  of  both  CA  and  GSR  transferring  highly  sensitive 
personal  data,  including  Facebook  derived  data,  over  unencrypted  and  insecure  emails. 

The  data  security  firm  UpGuard  revealed  significant  misconfigurations  in  CA’s  Ripon  codebase  which 
allowed  the  code  to  be  publicly  exposed.  The  firm  stated  that  “Also  exposed  among  these  tools  are 
numerous  credentials,  keys,  hashes,  usernames,  and  passwords  to  access  other  AIQ  assets,  including 
databases,  social  media  accounts,  and  Amazon  Web  Services  repositories,  raising  the  possibility  of 
attacks  by  any  malicious  actors  encountering  the  exposure  [...]  This  configuration  file,  like  all  the  others, 
contains  an  exposed  Facebook  app  ID  and  secret  key,  as  well  as  credentials  accessing  Twilio,  an  SMS 
messaging  service.” 

It  should  also  be  noted  that  CA’s  parent  company,  SCL  Group,  manages  NATO  psychological  operations 
projects  in  the  Baltic  region  and  would  have  likely  already  been  an  intelligence  target  for  the  FSB.  This 
means  that  in  addition  to  processing  Facebook  data  in  Russia,  there  are  reasonable  grounds  to  suspect 
that  CA  may  have  been  an  intelligence  target  of  Russian  security  services  at  the  time  of  Project  Ripon. 


COMPANY  STRUCTURE  AND  RELATIONSHIPS 


“Cambridge  Analytica  and  SCL  Group  are  different  companies.” 

This  is  also  dealt  with  above  in  the  introduction  to  the  companies  section.  To  reiterate,  Cambridge 
Analytica  (“CA”)  was  created  by  SCL  Group  with  funding  from  Robert  Mercer,  an  American  billionaire 
based  in  New  York.  Robert  Mercer  installed  the  alt-right  political  activist  Stephen  Bannon  as  CA’s  Vice 
President  with  responsibilities  to  manage  the  company  day-to-day.  Mr  Mercer  wanted  to  use  the  10 
tactics  SCL  had  used  on  military  projects  for  his  political  aims  in  the  United  States,  and  elsewhere, 
including  the  United  Kingdom.  CA’s  focus  was  to  adapt  these  strategies  for  politics,  as  well  as  research 
ways  to  modernise  and  deploy  10  approaches  in  online  social  networks.  CA  does  not  have  any  staff,  only 
an  intellectual  property  licence  and  data  assets.  SCL  licenced  all  its  IP  to  CA  and  in  return  CA  signed  an 
exclusive  service  provision  agreement  whereby  all  CA  clients  would  be  handed  to  SCL  staff  to  work  on. 
Although  there  are  technical  legal  distinctions  between  CA  and  SCL,  this  is  largely  to  get  around  various 
electoral  compliance  and  foreign  agent  restrictions  in  the  USA.  It  should  be  noted  that  in  practice  CA  and 
SCL  operate  day-to-day  as  the  same  company.  The  two  companies  share  the  same  offices  and  many  of 
the  same  directors. 

“Cambridge  Analytica  has  no  relationship  with  AggregatelQ.” 

Cambridge  Analytica  has  a  history  of  using  a  network  of  companies  to  obfuscate  its  precence  in  a  given 
country.  Mr  Nix  said  in  Channel  4’s  undercover  sting  that  CA  is  “used  to  operating  through  different 
vehicles,  in  the  shadows".  Mark  Turnbull,  CA’s  Managing  Director  also  referenced  using  hidden 
companies,  adding  that  “no  one  even  knew  they  were  there,  they  were  just  ghosted  in,  did  the  work, 
ghosted  out”. 

Aggregate  IQ  (“AIQ”)  is  a  Canadian  company  that  was  set  up  to  service  SCL  and  later  CA  projects  and 
build  database,  CRM  and  online  advertising  technologies  for  SCL/CA.  Prior  to  SCL,  AIQ  had  no  other 
clients.  The  reason  AIQ  was  set  up  originally  was  because  several  key  people,  who  later  became  the 
principle  officers  of  AIQ,  were  not  mobile  to  move  to  London  for  family  reasons.  The  compromise  was  to 
establish  a  company  in  Canada  and  IP  agreements  would  be  reached  so  that  SCL/CA  would  own  the 
products  of  their  work.  To  the  best  of  Mr  Wylie’s  knowledge,  AIQ  had  no  independent  clients  outside  of 
SCL/CA  from  2013  to  2016.  The  IP  licence  and  contracts  between  AIQ  and  CA/SCL  are  in  the 
possession  of  the  committee.  AIQ  was  listed  as  “SCL  Canada”  on  the  SCL  website  and  internal  staff  lists 
in  the  possession  of  the  committee  also  lists  Zack  Massingham,  the  CEO  of  AIQ,  as  “Head  of  SCL 
Canada”.  These  staff  lists  also  show  that  AIQ  was  responsible  for  hiring  and  managing  a  division  of 
SCL/CA’s  software  engineers. 

Contemporaneous  to  the  2016  EU  Referendum,  AIQ  was  working  for  CA  on  several  projects,  including 
Ted  Cruz’s  presidential  campaign.  This  would  have  necessitated  a  high  degree  of  interaction  between 
AIQ  and  CA,  especially  given  that  AIQ  built  the  “Ripon”  targeting  platform  for  CA.  The  data  security  firm 
UpGuard  reported  an  analysis  of  AIQ’s  internal  code  repository  that  showed  AIQ  developers  working  on 
code  for  Cambridge  Analytica’s  Ripon  software.  The  firm  stated  that,  “While  Cambridge  Analytica  may 
operate  as  an  independent  from,  distinct  from  AggregatelQ,  the  working  relationship  appears  to  be  much 
closer  -  as  evidenced  in  the  tale  of  an  app,  contained  in  the  exposed  repository.” 


MISSTATEMENTS  RELATING  TO  CHRISTOPHER  WYLIE 


“Mr  Wylie  was  only  a  part  time  contractor  at  CA  for  only  a  few  months.” 

Like  the  majority  of  the  early  team  at  Cambridge  Analytica  (“CA”),  Mr  Wylie  was  actually  retained  as 
consultant  to  CA  and  not  an  employee  of  CA.  That  is  why  he  set  up  the  company  at  around  the  same 
time  that  CA  was  being  incorporated.  He  did  not  mine  any  CA  dataset  for  his  own  ends.  In  common  with 
many  in  the  industry,  he  sometimes  uses  a  consulting  company.  As  a  consultant  he  did  not  have  set 
hours  but  worked  exclusively  for  SCL  and  CA  during  the  period  from  February  201 3  until  November  201 4. 

Mr  Wylie  was  only  at  CA  “for  a  few  months”  because  he  joined  SCL  Group  in  early  2013  well  before  CA 
existed  and  CA  was  not  fully  set  up  until  the  summer  of  2014.  He  had  the  title  of  “Director  of  Research” 
and  the  committee  has  scans  of  Mr  Wylie’s  old  business  cards.  Although  he  now  regrets  this,  Mr  Wylie 
played  a  pivotal  role  in  the  creation  of  CA,  including  meeting  Robert  Mercer,  negotiating  with  Mr  Mercer’s 
lawyers  and  creating  the  intellectual  basis  for  the  firm  through  his  prior  research  at  SCL. 

“Mr  Wylie  had  the  GSR  data  and  set  up  his  own  company.” 

Mr  Wylie  has  been  very  clear  on  this.  He  had  access  to  a  portion  of  the  Facebook  data  that  Dr  Kogan 
harvested  through  his  applications.  He  did  not  sell  that  data  or  use  it  on  client  projects  after  he  left 
Cambridge  Analytica 

When  Dr  Kogan  and  Mr  Wylie  first  met,  Dr  Kogan  said  he  was  setting  up  an  academic  institute  that  would 
be  aimed  at  furthering  the  emerging  field  of  computational  social  sciences.  Originally  this  was  to  be 
called  the  “Mutual  Science  Institute”,  but  as  “mutual”  is  a  protected  term  for  mutual  funds,  he  incorporated 
as  Global  Science  Research  (“GSR”).  Emails  relating  to  the  proposed  institute  are  with  the  committee. 

Mr  Wylie  agreed  to  help  Dr  Kogan  set  up  the  academic  institute,  as  he  thought  it  was  a  compelling  idea  to 
bridge  data  science  and  social  science  for  the  mutual  benefit  of  both  domains.  It  should  be  noted  that 
Facebook  has  said  that  it  was  also  under  the  impression  that  Dr  Kogan  was  collecting  data  for  academic 
use,  although  Mr  Wylie  was  not  part  of  those  discussions. 

Mr  Wylie  later  agreed  to  help  Dr  Kogan  acquire  more  data  for  the  institute  even  though  he  was  leaving 
Cambridge  Analytica,  as  he  thought  the  institute  was  a  promising  idea.  However,  he  later  discovered  that 
Dr  Kogan  went  back  to  CA  after  Mr  Wylie  left  and  was  discussing  commercialising  the  data  with  Mr  Nix, 
who  was  then  the  CEO  of  CA.  After  learning  that  Dr  Kogan  was  still  working  in  collaboration  with  CA,  and 
that  this  relationship  also  may  be  in  a  commercial  context,  he  did  not  continue  with  his  relationship  with  Dr 
Kogan  and  did  not  transfer  any  data  to  GSR.  Mr  Wylie  then  deleted  the  GSR-harvested  data  in  question. 

To  be  absolutely  clear,  Mr  Wylie  is  the  only  party  who  had  access  to  the  GSR-harvested  Facebook  data 
who  did  not  sell  the  data  or  use  it  on  client  projects.  Last  month,  the  UK  Information  Commissioner  wrote 
a  letter  stating  quite  clearly  that  not  only  is  Mr  Wylie  proactively  co-operating  with  British  authorities,  but 
that  Mr  Wylie  is  not  under  investigation.  Plainly,  had  he  been  involved  in  the  misuse  of  data,  the  ICO 
would  not  have  been  able  to  provide  that  assurance. 

“Mr  Wylie  left  CA  to  found  a  rival  firm.” 

Several  former  staff  and  consultants  from  CA  went  on  to  found  another  company  that  did  in  fact  start 
working  for  right  wing  candidates  in  the  USA.  To  be  clear,  Mr  Wylie  was  never  part  of  and  did  not  join 
that  other  company.  Instead  he  worked  on  the  things  that  interested  him:  fashion  projects  and 
progressive  campaigns.  Mr  Wylie  has  actually  turned  down  several  venture  capital  offers  because  he  is 
happy  with  the  freedom  his  current  work  gives  him. 

“Mr  Wylie  is  a  disgruntled  employee  who  took  confidential  information.” 


Mr  Wylie  is  in  possession  of  materials  from  Cambridge  Analytica:  these  were  the  same  documents  and 
emails  that  the  Guardian  and  New  York  Times  published  revealing  the  firm’s  unethical  practices  and 
wrongdoing.  He  retained  this  information  not  for  commercial  gain  but  because  he  was  concerned  about 
the  practices  of  the  company.  It  was  not  information  taken  in  order  to  compete  and  has  never  been  used 
in  that  way.  Any  breach  of  a  non-disclosure  agreement  is  clearly  justified  where  a  whistleblower  reveals 
potential  criminality  or  unethical  behaviour  as  in  this  case. 

“Mr  Wylie  was  forced  by  CA  to  sign  a  legal  settlement.” 

After  his  departure,  CA  continued  to  harass  Mr  Wylie  with  on-going  legal  threats  and  Mr  Wylie  agreed  to 
an  undertaking  that  he  would  not  solicit  Cambridge  Analytica’s  alt-right  clients  or  use  their  intellectual 
property,  such  as  “psy-ops”  or  the  firm’s  datasets.  Since  Mr  Wylie  did  not  plan  on  engaging  in 
psychological  warfare  in  elections,  or  working  for  the  American  alt-right,  he  agreed  to  those  terms. 
However,  the  undertaking  does  not  apply  for  public  interest  whistleblowing  where  the  confidential 
information  being  made  public  reveals  potential  criminality  or  unethical  behaviour. 

“Mr  Wylie  told  GSR  that  its  data  should  be  processed  in  America.” 

At  the  time,  Mr  Wylie  was  of  the  view  that  American  voter  data  should  be  processed  in  America,  rather 
than  ported  to  servers  in  several  different  countries,  which  would  create  potential  risks  to  those  American 
data  subjects.  It  should  be  noted  that  Dr  Kogan  frequently  travelled  to  Russia  and  recent  revelations 
about  his  Russian-funded  research  on  profiling  online  trolls  is  extremely  concerning. 

“Mr  Wylie  wrote  the  terms  and  conditions  of  the  GSR  app.” 

Mr  Wylie  drafted  a  version  of  Terms  of  Service  for  Dr  Kogan  after  he  googled  various  sample  app  terms. 
He  has  already  said  this  on  record.  It  was  up  to  Dr  Kogan  to  finalise  those  terms.  Dr  Kogan  was  the  one 
responsible  for  his  app’s  compliance  with  Facebook’s  terms,  not  Mr  Wylie,  as  it  was  not  Mr  Wylie’s  app 
and  he  was  never  given  access  or  control  of  the  app. 

“Mr  Wylie  once  made  reference  to  large  datasets  after  he  left  CA.” 

These  references  are  about  a  very  standard  dataset  of  registered  US  voters  with  some  additionally 
appended  consumer  data.  There  are  approximately  160  million  registered  US  voters,  so  this  number 
roughly  refers  to  the  number  of  records  sourced  from  US  voter  rolls.  Some  records  may  have  also 
included  people  who  were  likely  eligible  to  vote  but  had  not  yet  registered,  or  consumer  records  not  yet 
matched  to  a  voter  record.  Mr  Wylie  has  many  relationships  with  US  based  data  vendors  and  many  of 
those  same  datasets  are  used  by  campaigns  on  both  sides  of  the  aisle.  Mr  Wylie  had  access  to  this 
information  lawfully  and  with  the  appropriate  consents. 

“Mr  Wylie  is  not  a  data  scientist.” 

This  is  plainly  untrue.  Mr  Wylie  has  a  long  history  of  working  on  data  science  projects  and  was  endorsed 
for  a  Tier  1  Exceptional  Talent  visa  by  the  UK  Home  Office  specifically  on  the  basis  of  his  unique  data 
science  skills. 

“Mr  Wylie  was  banned  by  Facebook  too.” 

This  is  irrelevant  to  any  wrongdoing  by  Cambridge  Analytica  or  GSR.  Unlike  Facebook,  Cambridge 
Analytica  or  GSR,  Mr  Wylie  proactively  disclosed  evidence  to  the  Information  Commissioner’s  Office  and 
the  National  Crime  Agency.  Before  going  public,  he  spent  months  working  with  the  authorities  to  help 
with  their  investigation.  Given  that  Facebook  has  just  announced  a  new  reward  programme  with 
“bounties”  for  those  who  report  security  flaws,  it  is  baffling  as  to  why  Mr  Wylie  is  still  banned.  Mr  Wylie  is 
the  only  party  who  had  access  to  the  GSR-harvested  Facebook  data  who  did  not  sell  the  data  or  use  it  on 
client  projects.  Last  month,  the  UK  Information  Commissioner  wrote  a  letter  stating  quite  clearly  that  that 


Mr  Wylie  is  not  under  investigation.  Plainly,  had  he  been  involved  in  the  misuse  of  data,  the  ICO  would 
not  have  been  able  to  provide  that  assurance. 


